--- a/sys/bus/u4b/storage/umass.c
+++ b/sys/bus/u4b/storage/umass.c
@@ -2327,6 +2327,14 @@
 						vpd_serial->length = strlen(pserial);
 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
 							vpd_serial->length = sizeof(vpd_serial->serial_num);
+						if (ccb->csio.dxfer_len <
+						    (uint32_t)vpd_serial->length + 4) {
+							/* caller buffer too small */
+							if (ccb->csio.dxfer_len < 4)
+								goto done;
+							vpd_serial->length =
+							    ccb->csio.dxfer_len - 4;
+						}
 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
 						ccb->csio.scsi_status = SCSI_STATUS_OK;
 						ccb->ccb_h.status = CAM_REQ_CMP;
@@ -2585,7 +2593,9 @@
 
 			csio = &ccb->csio;
 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
-			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
+			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE &&
+			    (uint32_t)page_list->length + 4 + 1 <=
+			    csio->dxfer_len) {
 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
 				page_list->length++;
 			}